Repository navigation
[umbrella] Harden CI: 5 rubber-stamp vectors found in PR #155 audit #157
Description
Problem
PR #155 (and the reopened #156) showed that the Drop monorepo's CI is rubber-stamping. The adversarial audit identified 5 hardened findings. This issue tracks the umbrella remediation — child sub-issues split the work.
Root Causes (Confirmed)
| # | Finding | Severity | Evidence |
|---|---|---|---|
| F1 | develop branch has zero protection rules |
CRITICAL | gh api repos/BillyOutlast/drop/branches/develop/protection → HTTP 404 |
| F2 | All 15 workflows filter pull_request.branches: [rebuild] only |
HIGH | Verified ci.yml, server-ci.yml, cli-ci.yml, desktop-ci.yml, droplet-ci.yml, e2e.yml, codeql.yml, osv-scanner.yml, editorconfig-ci.yml, open-code-review.yml — zero list develop |
| F3 | Four continue-on-error: true mask security/quality failures |
HIGH | ci.yml:97 pnpm audit, ci.yml:220 SonarCloud, osv-scanner.yml:31, .github/actions/rust-ci/action.yml:129 cargo audit |
| F4 | Codecov is purely informational | HIGH | fail_ci_if_error: false ×3 (ci.yml:174, server-ci.yml:125, rust-ci/action.yml:122). Baseline 29.32%, no codecov.yml exists |
| F5 | Per-workspace path filters skip root-config commits | MEDIUM | cli-ci.yml, desktop-ci.yml, droplet-ci.yml lack pnpm-workspace.yaml in paths: |
Sub-issues (Wave Order)
- PR-A / Phase 1: Branch protection on
rebuild+develop(CRITICAL) — HIGH risk, must land first - PR-A / Phase 2: Add
developtopull_request.branchesin all workflows - PR-B / Phase 3: Continue-on-error triage (SonarCloud unmask, pnpm/cargo new-vuln detection, OSV doc)
- PR-B / Phase 4: Add
.github/codecov.ymlwith informational thresholds - PR-C / Phase 5: Per-workspace root-config paths
Verification
End-to-end synthetic PR tests (A-E) per the adversarial plan bundle:
- A: PR to
developfires all required workflows - B: Coverage drop shows red patch comment, non-blocking
- C: SonarCloud quality gate failure blocks merge
- D: Root-config-only commit triggers per-workspace CIs
- E: New critical vuln fails workflow
Provenance
Adversarial 4-member hyperplan (skeptic / workflow-archaeologist / log-forensics / remediation-architect), 3 rounds: independent analysis → cross-attack → defend/refine/concede. Cross-attack verdicts: 5 hardened findings, 7 overturned, 3 downgraded. Plan agent sequenced with 3 execution waves.
Target total effort: ~5.5 hours across 3 stacked PRs.
Activity